26f178e5fa
Compose the two salvaged approaches (#78065 + #78511): - Keep #78065's terminal-only scrub-path exemption (first-party prefix predicate in _make_run_env / _sanitize_subprocess_env, plain env values never scope-resolved, snapshot exclusion for cross-profile isolation, every non-terminal surface sealed). - Fold #78511's BUZZ_MANAGED_AGENT signal into a context gate instead of an import-time blocklist discard: the blocklist is shared by every scrub surface, so discarding there would leak BUZZ_PRIVATE_KEY into execute_code / hermes_subprocess_env children too. - New gate _buzz_terminal_context_active(): BUZZ_MANAGED_AGENT in the process env (Buzz Desktop buzz-acp harness, #76243) OR the live session's platform is buzz (HERMES_SESSION_PLATFORM ContextVar, concurrency-safe under a multi-session gateway). A Telegram/CLI/cron session on a host that also runs a Buzz gateway does NOT get the signing key in its terminal children (maintainer triage note on #76243: don't expose the key to unrelated shell commands). - Snapshot exclusion stays prefix-only (conservative even when the gate is inactive). - Tests updated for the gate + new negative test (non-Buzz session strips) and positive test (buzz session platform enables carve-out); docs updated accordingly. Closes #78026, closes #76243.
Website
This website is built using Docusaurus, a modern static website generator.
Installation
yarn
Local Development
yarn start
This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
Build
yarn build
This command generates static content into the build directory and can be served using any static contents hosting service.
Deployment
Using SSH:
USE_SSH=true yarn deploy
Not using SSH:
GIT_USER=<Your GitHub username> yarn deploy
If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the gh-pages branch.
Diagram Linting
CI runs ascii-guard to lint docs for ASCII box diagrams. Use Mermaid (````mermaid`) or plain lists/tables instead of ASCII boxes to avoid CI failures.